f7dfc6796763a5bece671610081314f533aae6d7ed944a38119feac25f5ab8ed

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BBSAKv1.9.2_Installer.msi
Size 1.3MB
Sample260721-wyncpszshs
SHA256 f7dfc6796763a5bece671610081314f533aae6d7ed944a38119feac25f5ab8ed
MD5 75abe984688fef846ab7af0f36dd6e73
SHA1 8d1b525728668555bf1494cd40c27dc8065f9af3
SHA512 bb4ff812ebbe5f371aac2c049e8af3fa7da4f2f1d4ef854e49b85d6d82f5429ac59a338db75f8aa26d1ff7dd82496ca6b1ee06c6a2ab3e5a40b6d0b58f7eff13
SSDEEP 24576:Wi2G1n9AGyaBlE+0UsvTSiJF261LuVqLyiiT6WCRjEVydeC6QlyilChllk:Wi2G19HBlEvpvTLJF269q6zk7C6nyCy
TLSH
T15B55E12037C6DB31C1C321B4926EA7204679AC203B65CD8372D43BDE6971BE1AF6579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3776	BBSAK.exe
4320	javaloader.exe
4524	BBSAK.exe
5028	javaloader.exe

Loads dropped DLL 4 IoCs

pid	Process
536	MsiExec.exe
536	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BBSAK\Language.txt	msiexec.exe
File created	C:\Program Files (x86)\BBSAK\BBSAK.exe	msiexec.exe
File created	C:\Program Files (x86)\BBSAK\javaloader.exe	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e596548.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596548.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI672D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6838.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B23F12D4-17DE-453A-B1F4-55E501FE0EBF}	msiexec.exe
File created	C:\Windows\Installer\e59654a.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1824	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaloader.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291316851138892"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4796	msiexec.exe
4796	msiexec.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe
3776	BBSAK.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1824	msiexec.exe
Token: SeSecurityPrivilege	4796	msiexec.exe
Token: SeCreateTokenPrivilege	1824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1824	msiexec.exe
Token: SeLockMemoryPrivilege	1824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1824	msiexec.exe
Token: SeMachineAccountPrivilege	1824	msiexec.exe
Token: SeTcbPrivilege	1824	msiexec.exe
Token: SeSecurityPrivilege	1824	msiexec.exe
Token: SeTakeOwnershipPrivilege	1824	msiexec.exe
Token: SeLoadDriverPrivilege	1824	msiexec.exe
Token: SeSystemProfilePrivilege	1824	msiexec.exe
Token: SeSystemtimePrivilege	1824	msiexec.exe
Token: SeProfSingleProcessPrivilege	1824	msiexec.exe
Token: SeIncBasePriorityPrivilege	1824	msiexec.exe
Token: SeCreatePagefilePrivilege	1824	msiexec.exe
Token: SeCreatePermanentPrivilege	1824	msiexec.exe
Token: SeBackupPrivilege	1824	msiexec.exe
Token: SeRestorePrivilege	1824	msiexec.exe
Token: SeShutdownPrivilege	1824	msiexec.exe
Token: SeDebugPrivilege	1824	msiexec.exe
Token: SeAuditPrivilege	1824	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1824	msiexec.exe
Token: SeChangeNotifyPrivilege	1824	msiexec.exe
Token: SeRemoteShutdownPrivilege	1824	msiexec.exe
Token: SeUndockPrivilege	1824	msiexec.exe
Token: SeSyncAgentPrivilege	1824	msiexec.exe
Token: SeEnableDelegationPrivilege	1824	msiexec.exe
Token: SeManageVolumePrivilege	1824	msiexec.exe
Token: SeImpersonatePrivilege	1824	msiexec.exe
Token: SeCreateGlobalPrivilege	1824	msiexec.exe
Token: SeCreateTokenPrivilege	1824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1824	msiexec.exe
Token: SeLockMemoryPrivilege	1824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1824	msiexec.exe
Token: SeMachineAccountPrivilege	1824	msiexec.exe
Token: SeTcbPrivilege	1824	msiexec.exe
Token: SeSecurityPrivilege	1824	msiexec.exe
Token: SeTakeOwnershipPrivilege	1824	msiexec.exe
Token: SeLoadDriverPrivilege	1824	msiexec.exe
Token: SeSystemProfilePrivilege	1824	msiexec.exe
Token: SeSystemtimePrivilege	1824	msiexec.exe
Token: SeProfSingleProcessPrivilege	1824	msiexec.exe
Token: SeIncBasePriorityPrivilege	1824	msiexec.exe
Token: SeCreatePagefilePrivilege	1824	msiexec.exe
Token: SeCreatePermanentPrivilege	1824	msiexec.exe
Token: SeBackupPrivilege	1824	msiexec.exe
Token: SeRestorePrivilege	1824	msiexec.exe
Token: SeShutdownPrivilege	1824	msiexec.exe
Token: SeDebugPrivilege	1824	msiexec.exe
Token: SeAuditPrivilege	1824	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1824	msiexec.exe
Token: SeChangeNotifyPrivilege	1824	msiexec.exe
Token: SeRemoteShutdownPrivilege	1824	msiexec.exe
Token: SeUndockPrivilege	1824	msiexec.exe
Token: SeSyncAgentPrivilege	1824	msiexec.exe
Token: SeEnableDelegationPrivilege	1824	msiexec.exe
Token: SeManageVolumePrivilege	1824	msiexec.exe
Token: SeImpersonatePrivilege	1824	msiexec.exe
Token: SeCreateGlobalPrivilege	1824	msiexec.exe
Token: SeCreateTokenPrivilege	1824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1824	msiexec.exe
Token: SeLockMemoryPrivilege	1824	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1824	msiexec.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
1824	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4320	javaloader.exe
5028	javaloader.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 536	4796	msiexec.exe	86
PID 4512 wrote to memory of 2680	4512	chrome.exe	100
PID 4512 wrote to memory of 2216	4512	chrome.exe	101
PID 4512 wrote to memory of 2216	4512	chrome.exe	101
PID 4512 wrote to memory of 640	4512	chrome.exe	102
PID 4512 wrote to memory of 2768	4512	chrome.exe	103
PID 4512 wrote to memory of 2768	4512	chrome.exe	103
PID 4512 wrote to memory of 4440	4512	chrome.exe	104
PID 4512 wrote to memory of 4444	4512	chrome.exe	105
PID 4512 wrote to memory of 4440	4512	chrome.exe	104
PID 4512 wrote to memory of 4444	4512	chrome.exe	105
PID 4512 wrote to memory of 964	4512	chrome.exe	107
PID 4512 wrote to memory of 964	4512	chrome.exe	107
PID 4512 wrote to memory of 552	4512	chrome.exe	108
PID 4512 wrote to memory of 552	4512	chrome.exe	108
PID 4512 wrote to memory of 2348	4512	chrome.exe	109
PID 4796 wrote to memory of 3632	4796	msiexec.exe	114
PID 4796 wrote to memory of 3448	4796	msiexec.exe	116
PID 3776 wrote to memory of 4320	3776	BBSAK.exe	121
PID 3776 wrote to memory of 5028	3776	BBSAK.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BBSAKv1.9.2_Installer.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1FFC934BCA5C092368E32910A3CB6443 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:536
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3632
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6C773873D09382FCAA474600567DC323
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe8c67c728,0x7ffe8c67c734,0x7ffe8c67c740
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4782759884149534797,5408147961472507515,262144 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,6072831633709124562,15121310062781923225,524288 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - System Time Discovery
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,8122927204769511584,16822322232438723221,524288 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,4328581743116825455,17251215911650671131,2097152 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,8246601808312880451,3037883777955370481,2097152 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4016,i,6670496677329447887,11500408699398918682,2097152 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,10193827568025737225,7173444327224276550,2097152 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,5639239407513809780,12202188169194902925,524288 --field-trial-handle=1896,i,16831748677998722302,13779735606637482251,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3088

C:\Program Files (x86)\BBSAK\BBSAK.exe
"C:\Program Files (x86)\BBSAK\BBSAK.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files (x86)\BBSAK\javaloader.exe
  "javaloader.exe" -u deviceinfo
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4320
- C:\Program Files (x86)\BBSAK\javaloader.exe
  "javaloader.exe" -u deviceinfo
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5028

C:\Program Files (x86)\BBSAK\BBSAK.exe
"C:\Program Files (x86)\BBSAK\BBSAK.exe"
1⤵
- Executes dropped EXE
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596549.rbs

Path C:\Config.Msi\e596549.rbs
Size 9KB
SHA256 5520259b82409f259bea98b9d789abda99b595c5272298d15f956eb04fc57a58
MD5 d2a898f3868e35b610df54b34b64d121
SHA1 1944d7f56798c8c3d1477d110bebffb384a4e595
SHA512 c9d0a5d10bb434af712be9c84c71a09f1b292208252cd20784a2ca76bd017f19af6be64cb6466b8412ec062345c0a441be4fa1de5cf8f83cb15ca1782a7df406
SSDEEP 96:0dhuTuDLeQ4VpIU7NiJACsThq6IU7NiJAC6jwG2Q4Thqp/HVB4SlptlowUF8uRoP:0dVeLpnxiJnIdnxiJnpvoJow3kpid
TLSH
T1EF127101B310C1D3EC5A5F38E3130BA577B6E3EAC210A76B1D9D85250F4AF8A5A696C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BBSAK.exe

Path C:\Program Files (x86)\BBSAK\BBSAK.exe
Size 1.4MB
SHA256 dcd13e8a6ba6b2ae69a47daba264c0065f27b8dd39d0b2b1345d7e7ca83daff6
MD5 a841220bb1d02ff481e3da56ec2fbd95
SHA1 ce80c5151fad8e2b98f3720d53c77f8f04f20305
SHA512 66bb49ae97d5bdc2e05eaecfd2a5f2dfd5756a54db6619891afeea363804ac7aeac9474a12101671883475e989d38f56d8c6cc80553128d16e0dd5d8971a6859
SSDEEP 12288:Vj8qSddeCl0fQqUphkrifJhqFuq3tK8QNO4UoFSaFLlgpCFPf8VG2hOHQkNBwn3q:eP9lgUphk5uqnefZFdmpCFC
TLSH
T18065BE207788DA61D66931F48A26C7C106A67D2A3D10DE1A7CF8779E19B22F3CE1315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Language.txt

Path C:\Program Files (x86)\BBSAK\Language.txt
Size 2KB
SHA256 00243eb1c28f5599c40ff1185f0d15e9fd6996849ce45574e564025e77decb27
MD5 6ca5a6be7a0110eda86dcdaaeb4e8010
SHA1 1681f79314b48bb70fc2a022dda30828ef934bd5
SHA512 0c51c5caa81fb4134259d13476204dce0d7109bff0b907fa613ee7be7eb462318a1f9dc34e3e67f3fb57efc7d4a9aae1c11589e495ed5722128610c88486f75f
TLSH
T16F41B83EC6C9D4E1164301C8FB06E5B3EA2D41F4473225E19C9DAEBC6250ABC533E5D5
MD5 SHA1 SHA512 TLSH

Submit Download

javaloader.exe

Path C:\Program Files (x86)\BBSAK\javaloader.exe
Size 286KB
SHA256 5a6a587e1c2e55669de29271d5916dcf150c3a4867cf3a6f33cb4b0ebd18ac05
MD5 13475a796ae1bbf1ec6b9c1e6ab1595e
SHA1 e10393745bc3e2f446cecb8f56d5540340ad5123
SHA512 f8c6b4d4364a552e7e9ddb4428bb303f6d1bee87828f297faf40521fc61dc501b87a68496e0b596e569316ac0a7230db160709cdbe5344ec686753454dce6915
SSDEEP 6144:6E1q2uvGpWNro29hJaavPfAVX1zLxrsbK700z/COgmZQAyO:6E1qHvGp6B9hJaavkXq
TLSH
T1C7549E1236E0C031E1526576892ACF71DB7AB87527355ACBBBD80B795F242D0EB7A30C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2842c627be72f182774bec3633594cc9ce4b9e5d962307ebb24e423a69616384
MD5 66b6a8883beb824f26ec064124d466e7
SHA1 8c42922ffa7549c85a73a72517a1df9b3b29bc86
SHA512 b002afc0d719bacfaef2f02fefdee4480d8af2b8a767ab7f6768b9fec264a18a366e97f8066d0418feef089163f04eb4606349150e351cd2f46815f8a92daa4d
TLSH
T17AE02BEECA209D2B19FD0719345D474BF754231B2B50455B3A3C8209CFB8636158AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b8e3bfab84a64246a60d56a4920fe12ce6f2cc9c5755cde7989861fc19f50fca
MD5 7627e7340194e76bd2f9df3d5e83f5a7
SHA1 6656fa54859db106b35413b35c03ec00ec91ff49
SHA512 9be5154cdd4bea2a97c4b028f43b3215adee180a18151ca2fff1b9d0c34867eeecc8700e7879b29f225510cd96505d125c4c42ed56569afedf17bef10302207e
TLSH
T11641ACF793E489BD8A1196F4AB146F1FCE790955131C7C6288D46E1B83E2872D25028F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 782cc3c77057cc698e4eb420af69f37d52b7048e3b3d0870af2f619251df8122
MD5 c5d50303386b45d03b00e4bdc8b43c61
SHA1 120c9cf265bfb71e3cee00066374e7066b54a13a
SHA512 527358f42cc58822fbd815b719fddf7878775ce15734bbe22b61f5e19a484fb56890cd4ec7ffd0683480b7f59ecd5016cc43d5e94cc0227d4b578cd009cc70b7
TLSH
T1E8F059ABAA797067507D09BB1E047C4A7576E8310542ACE8DE6A822DE1D15F31F12863
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f5324343c2596e9587f72de36130663388b90e1617d5626033fa2f07cd00bd78
MD5 cb6e70e04a903db131ae439d336b64c5
SHA1 1c346192e42539e9474104eeac7639d0bfe55131
SHA512 d024a4a01940f66e01ca3b56a7f1d297f1504e875293939fcc1f744156b48f3381152c236762d3ab3b7e74343b112335b30f102740f09d537e88d26f6e403785
SSDEEP 192:oRKAjWzlI0tgMgKv72ympAPRp2/95Hsb+WNnbH0S1PyIsnAUge:oRKAsQGQUXo7wL0me
TLSH
T1AD32C66FA910653B6DC7C31AF9267763E7F5107225902E44EAFC9B2C15E79CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 34ae856f1866be31c2fb2a82f801e8d6ae12ee606762d55ec4b8abcb24733590
MD5 81ceb2b766ab89b3cfb0efa9acb97b72
SHA1 a14b0abd9f67926c9a9d85e53fc209e4fed35285
SHA512 3f59886eeeea93a70a10203d7c66b4d24afb127a74b1272a7370d516e65751e1438eca5d7b24c88245488cca70951aafa1a71b7b0576f87c90ca7acbc4aa357e
TLSH
T1C3B0124480015111C14306B41103188C7304DF10D509170183F4BA66C8290618034091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f170.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f170.TMP
Size 96B
SHA256 a9f2e5fd2b015a4bb1f737d311d1d14193f63e205185b7223b3557bba2eb6189
MD5 aadb3b53edd193b6df14c7ab2d20b2aa
SHA1 7b88c43d3204474495e0fbb15a1454cc61a057a2
SHA512 c1d57b61db513e7983e610c0f9bc18e7691046549f8aebea7d9e443833e09533858444cc590cb11eeb66b867d073c31bcdebeedfa36b56654669ca3c70b71eae
TLSH
T1A8B022AAC20332A2C08203F0288080CC3020CF20C203232AC2F03AA3CC203E02020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9236f6c9708f9ef69e3420a76836149534139fc4da30460b5243f917f75c03c5
MD5 0b7db5837ff68e5b28954b6426cadd84
SHA1 4c5b6c6cfe5755315e9bf4a568a5369bdb1b8827
SHA512 b6815921dd435f15a24ec97b836ba2e8ce8b6f4eb218687696f7535b46f950ba09019d7797b4d6c5ee0283d41b12d0989578e931ea8fc74e590bddef32a37f13
SSDEEP 3072:fCW9V8MZ36dTER6gitObINQiPcV6AUOjFVCQfgn0qfd7NtZL8cHQRZEQ6Spsa:fZVhSTER6NOJiPc0oVzg0qZ/ZLW3Exa
TLSH
T158341233AB646D37CA418F3075136ECB33FAAA61C428D7049BB93BD76943CA530415AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 47c58df9ee3486a0f9ca067c166ff4e14656c9a87d83afe09e2714292ede6d3d
MD5 3a979c464cf3d8e43576a740eaf9c44a
SHA1 57fef26c49eebc99039bce39eb255ec03f4b4ab4
SHA512 4193f55359e2d88bd8704183bf618640d2bb491d278f98d6b3e9c33d652e4db942e64aea0ae9652efb778c39bbadeccf3a2aa73beb4a16ed17d2ed21364c00af
SSDEEP 1536:TTQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:qqfd7NtZL8cHQRZEQ6Spsk
TLSH
T16EC30237DBC21F339E92CB60B9530FD6A7B644A59034D301EABD77AF6C83891644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIFE55.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIFE55.tmp
Size 221KB
SHA256 ba56a2fa13e5dae48b6d74a8fa40f2f44473b386e71ba1e7ec2ded90ad56bb8b
MD5 911aa8d08b7ccab654e897b0e4439354
SHA1 4f4f16048deae47a2ff5b9849042f62ec51794bc
SHA512 8aa11f26093e54a62c5390c64e218a8a57cd3374bbce8ecc243042dd8a2214ede1f3befa699837698c0bd42b9b4e011f95c62588b8bdd4da9aae12dabe4b46e4
SSDEEP 3072:oCwtulBs61sjBGyhrhirKFalevt64totKL7BCSj086gbTv075x2K1kv398G8Haf1:3o9hEcaGt5PBCSnR/c/LSP9tRzSQ
TLSH
T122245B2136D0D131E5E321B846ACA6711ABEF5B15B70C5C7B38407EE9AB17D0AB3874B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596548.msi

Path C:\Windows\Installer\e596548.msi
Size 1.3MB
SHA256 f7dfc6796763a5bece671610081314f533aae6d7ed944a38119feac25f5ab8ed
MD5 75abe984688fef846ab7af0f36dd6e73
SHA1 8d1b525728668555bf1494cd40c27dc8065f9af3
SHA512 bb4ff812ebbe5f371aac2c049e8af3fa7da4f2f1d4ef854e49b85d6d82f5429ac59a338db75f8aa26d1ff7dd82496ca6b1ee06c6a2ab3e5a40b6d0b58f7eff13
SSDEEP 24576:Wi2G1n9AGyaBlE+0UsvTSiJF261LuVqLyiiT6WCRjEVydeC6QlyilChllk:Wi2G19HBlEvpvTLJF269q6zk7C6nyCy
TLSH
T15B55E12037C6DB31C1C321B4926EA7204679AC203B65CD8372D43BDE6971BE1AF6579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 8ff7cf3f886389079961833881cde2a6015d9afafd9799297439910b68f7e800
MD5 396868a9a93db1379a14d8dd51208693
SHA1 886d4659bbade8b28ab67fbf902dea72aa3a7aa7
SHA512 a7065514365c2c4caa4a10f9778bed0266394d8b5ac92d57dd167a6b7b46a10379b9a4ee1811a58173a462f4321d93c5f290a0bef9029359948fbd2eb67a9894
SSDEEP 24576:iu8m+1z1doO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:w
TLSH
T1DA47D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4b241f1e-3537-48ff-ac0f-cf729351ad87}_OnDiskSnapshotProp

Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4b241f1e-3537-48ff-ac0f-cf729351ad87}_OnDiskSnapshotProp
Size 6KB
SHA256 387bf86a2d126cf65993a0499ad8c26d090322761ac2d4aaa3616f77befd0527
MD5 700cf142d1bab1fc0f9e9ffa6bb643ca
SHA1 76f08178b9594c9f5f994972c2815adc1b566d8b
SHA512 e8a6673f15ad0f9b816180183fa8232548d409114c1b5b5b56deb3c95ff486357588ff70213dd1ac3dd588f56ec34d5bda0b47d1772ce5028d6bfbd8a1b30d41
SSDEEP 96:FaHMclSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:c+b++ZVmN
TLSH
T109D19A085AF54711E2B3AB7129F18557A877B811EF33CB8E0198638E6670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3776-185-0x000000001CD90000-0x000000001CDDC000-memory.dmp

Download

memory/3776-184-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

Download

memory/3776-183-0x000000001CB30000-0x000000001CBCC000-memory.dmp

Download

memory/3776-182-0x000000001BAE0000-0x000000001BFAE000-memory.dmp

Download

memory/3776-181-0x000000001B530000-0x000000001B5D6000-memory.dmp

Download

memory/3776-193-0x00000000204B0000-0x00000000204D4000-memory.dmp

Download